[Bro-Dev] Bro + real-time question

[Seth Hall]

On Sep 28, 2014, at 7:57 PM, Vern Paxson <vern at icir.org> wrote:

> For a different approach to the problem, see section 5.3 ("Dynamically
> controlling packet load") in the Operational Experiences paper,
> http://www.icir.org/vern/papers/high-volume-ccs04.pdf .

Ah!  I don't think I've actually read this paper before, but if my quick skim is correct, this paper is where the old load-level.bro script came from, right?  I've been wanting to bring that capability back in some form for a long time (and I've even written a couple of draft modules at various points in time).

 .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/